Learn L2TP IPsec - PPP & L2TP Configuration

#Introduction

In episode 2 we assembled the L2TP/IPsec stack and learned that PPP is the innermost layer. Episode 7 focuses on the two layers you will configure most often: PPP, which carries user data, and L2TP, which forms the tunnel and sessions. This is the layer where usernames, passwords, and IP addresses are handled.

Many L2TP/IPsec configuration mistakes actually happen here — mismatched authentication protocols, or an incomplete handshake sequence. By understanding PPP and L2TP separately, you can map every error log to the right layer.

#PPP: Point-to-Point Protocol

#Encapsulation on Top of L2TP

PPP is a link-layer protocol that runs point-to-point. Inside L2TP, PPP frames are wrapped as Data Message payloads and forwarded through the tunnel. PPP carries three important protocols: LCP to negotiate the link itself, NCP such as IPCP to set the IP address, and the authentication protocols discussed below.

#PPP Authentication Protocols

PPP defines several authentication protocols with different levels of security:

• PAP: the password is sent in clear text — very weak, better rejected.
• CHAP: challenges with a hash-based challenge-response — better than PAP.
• MS-CHAPv2: Microsoft's version with mutual authentication, but based on MD4, which is starting to weaken.
• EAP: a framework that can wrap modern methods such as EAP-TLS.

For L2TP/IPsec, the common combination is MS-CHAPv2 with MPPE encryption. On the server side, the allowed protocols are controlled through pppd options:

name l2tpd
require-mschap-v2
refuse-pap
refuse-chap
ms-dns 8.8.8.8
ms-dns 1.1.1.1
proxyarp
idle 1800

The refuse-pap and refuse-chap lines force clients up to MS-CHAPv2, while require-mschap-v2 mandates two-way authentication.

#L2TP Tunnel and Session

#Building the Tunnel: SCCRQ, SCCRP, SCCCN

Before data flows, the LAC and LNS must build an L2TP tunnel. The LAC sends SCCRQ (Start-Control-Connection-Request) to the LNS. The LNS answers SCCRP (Start-Control-Connection-Reply), and the LAC closes with SCCCN (Start-Control-Connection-Connected). The tunnel is formed.

#Building the Session: ICRQ, ICRP, ICCN

Inside the tunnel, every user connection opens its own session. The LAC sends ICRQ (Incoming-Call-Request), the LNS replies ICRP (Incoming-Call-Reply), and the LAC completes it with ICCN (Incoming-Call-Connected). After ICCN, the PPP negotiation — LCP, authentication, then IPCP — begins on top of that session.

The complete sequence:

SCCRQ -> SCCRP -> SCCCN   (tunnel)
ICRQ  -> ICRP  -> ICCN    (session)
LCP -> otentikasi -> IPCP (PPP)

#Connecting PPP to L2TP in xl2tpd

#PPP Options via pppoptfile

xl2tpd does not run PPP itself; it hands the session to pppd and tells pppd through an options file. In /etc/xl2tpd/xl2tpd.conf, point to it with pppoptfile:

[lns default]
ip range = 192.168.42.10-192.168.42.250
local ip = 192.168.42.1
require chap = yes
refuse pap = yes
require authentication = yes
name = l2tpd
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

The require chap = yes and refuse pap = yes columns set the authentication protocols on the L2TP side, while pppoptfile points to the pppd options file we wrote above. The two must be consistent: do not refuse PAP on one side while allowing it on the other.

#Debugging with PPP Logs

When a session misbehaves, enable debugging on both layers:

sudo journalctl -u xl2tpd -f
sudo tail -f /var/log/syslog | grep pppd

After a client connects, check the interface created by pppd:

ip addr show ppp0
ip route

If ppp0 appears with address 192.168.42.x, the PPP negotiation succeeded. If not, direct your attention to the pppd logs — most authentication failures are recorded there clearly.

#Closing

Episode 7 equipped you with the two innermost layers of L2TP/IPsec: PPP, which carries data and authenticates users, and L2TP, which forms the tunnel and sessions through the SCCRQ-to-ICCN sequence. You also wrote your first set of interdependent PPP options and LNS configuration.

Key takeaways:

• PPP carries LCP, NCP, and authentication protocols over the L2TP tunnel.
• PAP is weak; MS-CHAPv2 is the common choice for remote access.
• The L2TP tunnel is built through SCCRQ, SCCRP, SCCCN.
• The L2TP session is built through ICRQ, ICRP, ICCN.
• xl2tpd hands the session to pppd via pppoptfile.
• The pppd logs are the first place to check authentication failures.

In the next episode, episode 8, we will discuss tools and troubleshooting — how to use ipsec statusall, ipsec barf, swanctl --list-sas, and xl2tp-control to trace problems from the IKE layer down to the PPP session.